GSM supports a number of different encryption techniques to cipher the data at layer 1 on the radio interface. These encryption techniques are known as A5/1, A5/3 and A5/4, in accordance with the Third Generation Partnership Project (3GPP), “Technical Specification Group Services and System Aspects; Security Related Network Features”, Technical Specification 43.020 V9.1.0, Dec. 18, 2009 the contents of which are incorporated herein by reference.
A5/1 encryption is the most commonly used encryption technique for GSM, and support for A5/1 is mandatory for all GSM mobile devices since GSM Release-1999. A5/3 and A5/4 are more robust encryption algorithms, which have been specified more recently by 3GPP and are not yet widely supported among mobile devices or networks currently in operation.
Physical layer (Layer 1) security in GSM using the A5/1 cipher is vulnerable to being broken, and the exploitation of the vulnerability has been shown by researchers to be practical through a “known plain text” attack on GSM speech calls utilizing the A5/1 cipher.
A known plain text attack can be performed on an encryption algorithm when ciphered blocks of known text are available to an attacker. In case of GSM, during the speech call, signaling over the slow associated control channel (SACCH) is known to be vulnerable to known plain text attacks as the contents of the SACCH during the speech call constitute periodically repetitive and predictable information. In particular, the SACCH periodically transmits information specific to the neighbor cell configuration. The same information is also broadcast on the broadcast control channel (BCCH) of the cell in an unencrypted fashion and can be read by any mobile in the cell (and, hence, available to the attacker). Also, the information may be sent on the SACCH in an unencrypted format prior to the establishment of the ciphering operation.
The information specific to the neighbor cell configuration for a given cell is typically static and, therefore, typically does not change during the call. The system information (SI) messages transmitted over the SACCH carry the neighbor cell configuration information during the call. Ciphering of this “known” text in the system information messages sent on the SACCH renders the contents of the encrypted SACCH open to so-called known plain text attacks to obtain the cipher session key. In general, an issue associated with SACCH is the possibility that information transmitted ciphered on SACCH may be obtained from other (unciphered, or de-ciphered) sources, and that this information may be repeatedly transmitted on SACCH. Neighbor cell information is one such example.